Yakuniy loyiha — to'liq stack ni konteynerlash va deploy

# syntax=docker/dockerfile:1
FROM node:22-alpine AS base
WORKDIR /app

FROM base AS deps
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci

FROM deps AS dev
COPY . .
CMD ["npm", "run", "dev"]

FROM deps AS build
COPY . .
RUN npm run build

FROM base AS production
ENV NODE_ENV=production
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev
COPY --from=build --chown=node:node /app/dist ./dist
USER node
EXPOSE 3000
HEALTHCHECK --interval=15s --timeout=3s --start-period=15s --retries=3 \
  CMD wget -qO- http://localhost:3000/health || exit 1
CMD ["node", "dist/server.js"]

.dockerignore:

node_modules
dist
.git
.env*
!.env.example
*.log
coverage

Worker — xuddi shu image, command: ["node", "dist/worker.js"].

# syntax=docker/dockerfile:1
FROM node:22-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY . .
RUN npm run build

FROM nginx:1.27-alpine
COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY --from=build /app/dist /usr/share/nginx/html
EXPOSE 80

nginx.conf:

server {
    listen 80;
    root /usr/share/nginx/html;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html;
    }
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
    location = /index.html {
        add_header Cache-Control "no-cache";
    }
    gzip on;
    gzip_types text/css application/javascript application/json image/svg+xml;
}

Frontend kodida: fetch('/api/mahsulotlar').

compose.yaml:

name: dokon

services:
  api:
    build:
      context: ./api
      target: production
    environment:
      DATABASE_URL: mysql://dokon:${DB_PASSWORD:?}@db:3306/dokon
      REDIS_URL: redis://redis:6379
    depends_on:
      db: { condition: service_healthy }
      redis: { condition: service_healthy }
    networks: [frontend, backend]

  worker:
    build:
      context: ./api
      target: production
    command: ["node", "dist/worker.js"]
    environment:
      DATABASE_URL: mysql://dokon:${DB_PASSWORD}@db:3306/dokon
      REDIS_URL: redis://redis:6379
    depends_on:
      redis: { condition: service_healthy }
    networks: [backend]

  web:
    build: ./frontend
    networks: [frontend]

  db:
    image: mysql:8.4
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:?}
      MYSQL_DATABASE: dokon
      MYSQL_USER: dokon
      MYSQL_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "--silent"]
      interval: 5s
      retries: 20
    networks: [backend]

  redis:
    image: redis:7-alpine
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
    networks: [backend]

  adminer:
    image: adminer
    profiles: [tools]
    ports: ["127.0.0.1:8081:8080"]
    networks: [backend]

networks:
  frontend:
  backend:

volumes:
  db-data:

compose.override.yaml (avtomatik qo'llanadi):

services:
  api:
    build:
      target: dev
    ports: ["3000:3000"]
    develop:
      watch:
        - action: sync
          path: ./api/src
          target: /app/src
        - action: rebuild
          path: ./api/package.json

  web:
    build:
      target: build
    command: npm run dev -- --host 0.0.0.0
    ports: ["5173:5173"]
    develop:
      watch:
        - action: sync
          path: ./frontend/src
          target: /app/src

  db:
    ports: ["127.0.0.1:3306:3306"]

Vite dev serverida /api ni API ga proxy qiling (vite.config.js → server.proxy: { '/api': 'http://api:3000' }).

cp .env.example .env
docker compose up --watch
docker compose --profile tools up -d adminer

Dev da backend internal emas — lokal portlar kerak. Production da (5-bosqich) — internal: true.

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          context: ./api
          target: dev
          load: true
          tags: dokon-api:test
          cache-from: type=gha,scope=api
          cache-to: type=gha,mode=max,scope=api
      - run: docker run --rm dokon-api:test npm test

  build:
    needs: test
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        include:
          - name: api
            context: ./api
            target: production
          - name: web
            context: ./frontend
            target: ""
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: ${{ matrix.context }}
          target: ${{ matrix.target }}
          push: true
          tags: |
            ghcr.io/${{ github.repository }}-${{ matrix.name }}:sha-${{ github.sha }}
            ghcr.io/${{ github.repository }}-${{ matrix.name }}:latest
          cache-from: type=gha,scope=${{ matrix.name }}
          cache-to: type=gha,mode=max,scope=${{ matrix.name }}
      - uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: ghcr.io/${{ github.repository }}-${{ matrix.name }}:sha-${{ github.sha }}
          severity: CRITICAL
          exit-code: "1"
          ignore-unfixed: true

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: deploy
          key: ${{ secrets.SERVER_SSH_KEY }}
          script: |
            cd /opt/dokon
            export TAG=sha-${{ github.sha }}
            echo "TAG=$TAG" > .tag
            docker compose --env-file .env --env-file .tag pull
            docker compose --env-file .env --env-file .tag up -d
            docker image prune -f

• matrix — bitta job ta'rifi, ikki image
• scope — har image uchun alohida kesh
• .tag fayl — joriy versiya serverda saqlanadi (keyingi up -d larda ham, rollback uchun ham)

deploy/compose.yaml (serverda /opt/dokon/compose.yaml):

name: dokon

x-xavfsiz: &xavfsiz
  restart: unless-stopped
  read_only: true
  tmpfs: [/tmp]
  cap_drop: [ALL]
  security_opt: [no-new-privileges:true]
  logging:
    driver: local
    options: { max-size: "10m", max-file: "3" }

services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports: ["80:80", "443:443", "443:443/udp"]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    networks: [frontend]

  web:
    image: ghcr.io/firdavsdev07/dokon-web:${TAG:-latest}
    restart: unless-stopped
    deploy:
      resources:
        limits: { memory: 64M }
    networks: [frontend]

  api:
    <<: *xavfsiz
    image: ghcr.io/firdavsdev07/dokon-api:${TAG:-latest}
    environment:
      DATABASE_URL: mysql://dokon:${DB_PASSWORD:?}@db:3306/dokon
      REDIS_URL: redis://redis:6379
      NODE_OPTIONS: --max-old-space-size=384
    deploy:
      resources:
        limits: { memory: 512M, cpus: "1.0" }
    depends_on:
      db: { condition: service_healthy }
      redis: { condition: service_healthy }
    networks: [frontend, backend]

  worker:
    <<: *xavfsiz
    image: ghcr.io/firdavsdev07/dokon-api:${TAG:-latest}
    command: ["node", "dist/worker.js"]
    environment:
      DATABASE_URL: mysql://dokon:${DB_PASSWORD}@db:3306/dokon
      REDIS_URL: redis://redis:6379
      SMTP_URL: ${SMTP_URL:?}
    deploy:
      resources:
        limits: { memory: 256M }
    networks: [backend, egress]

  db:
    image: mysql:8.4
    restart: unless-stopped
    command: --innodb-buffer-pool-size=512M
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:?}
      MYSQL_DATABASE: dokon
      MYSQL_USER: dokon
      MYSQL_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db-data:/var/lib/mysql
    deploy:
      resources:
        limits: { memory: 1G }
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "--silent"]
      interval: 5s
      retries: 20
    networks: [backend]

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --maxmemory 100mb --maxmemory-policy allkeys-lru
    deploy:
      resources:
        limits: { memory: 128M }
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
    networks: [backend]

networks:
  frontend:
  backend:
    internal: true
  egress:                 # worker email yuborishi uchun internetga chiqish

volumes:
  caddy-data:
  caddy-config:
  db-data:

• x-xavfsiz + <<: *xavfsiz — YAML anchor: umumiy sozlamalar bir marta yoziladi (31-dars)
• backend: internal — baza va Redis internetga umuman chiqa olmaydi
• worker email yuborishi uchun — alohida egress tarmog'i (internal tarmoq tashqariga chiqishni ham yopadi)
• api frontend tarmog'i orqali Caddy bilan, backend orqali baza bilan

deploy/Caddyfile:

dokon.uz {
    encode gzip zstd
    handle /api/* {
        reverse_proxy api:3000
    }
    handle {
        reverse_proxy web:80
    }
}

www.dokon.uz {
    redir https://dokon.uz{uri} permanent
}

/api/* uchun handle (handle_path emas) — prefiks saqlanadi, chunki API marshrutlari /api/... bilan boshlanadi.

/opt/dokon/backup.sh:

#!/bin/sh
set -e
cd /opt/dokon
SANA=$(date +%F_%H%M)
FAYL=backups/dokon_$SANA.sql.gz

docker compose exec -T db sh -c \
  'mysqldump -u root -p"$MYSQL_ROOT_PASSWORD" --single-transaction --routines dokon' \
  | gzip > "$FAYL"

# Bo'sh yoki buzilgan zaxirani aniqlash
gzip -t "$FAYL"
[ "$(stat -c%s "$FAYL")" -gt 1000 ] || { echo "Zaxira juda kichik!"; exit 1; }

rclone copy "$FAYL" b2:dokon-backups/
find backups -name "*.sql.gz" -mtime +14 -delete

# crontab -e
0 3 * * * /opt/dokon/backup.sh >> /var/log/dokon-backup.log 2>&1

Tiklash sinovi (oyiga bir marta, alohida konteynerda):

docker run -d --name tiklash-sinov -e MYSQL_ROOT_PASSWORD=sinov mysql:8.4
sleep 30
gunzip -c backups/dokon_2026-11-06_0300.sql.gz \
  | docker exec -i tiklash-sinov sh -c 'mysql -u root -psinov -e "CREATE DATABASE dokon" && mysql -u root -psinov dokon'
docker exec tiklash-sinov mysql -u root -psinov -e "SELECT COUNT(*) FROM dokon.buyurtmalar"
docker rm -f tiklash-sinov

Monitoring: UptimeRobot / Better Stack (yoki boshqa serverdagi Uptime Kuma) da https://dokon.uz/api/health ni har daqiqada tekshirish + Telegram bildirishnomasi.